Integrating sd-wan constructions with security

Abstract

Techniques are described for automatically integrating SD-WAN constructs into security policies. The technique may include defining, by a secure cloud provider, a security policy for an entity represented by a VPN security policy tag, and the security policy being free of a source CIDR IP address and also free of a destination CIDR IP address. The secure cloud provider notifies the SD-WAN controller of the security policy. And the SD-WAN controller maps the VPN security policy label to the IP address pool and the VPN ID. The SD-WAN controller generates an enhanced security policy by automatically adding the source CIDR IP address and the destination CIDR IP address to the security policy. The SD-WAN controller deploys the enhanced security policy to the SD-WAN branch router and generates a VPN segment between the SD-WAN branch router and the secure cloud provider to establish a public security Internet gateway tunnel for the IP address pool.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to U.S. Patent Application No. 18 / 224,220, filed on July 20, 2023, the entire contents of which are incorporated herein by reference. Technical Field

[0003] The present disclosure generally relates to automatically integrating SD-WAN constructs into SASE security policies and automating security policy enrichment based on events in the SD-WAN (e.g., VPN addition / deletion and network device addition / deletion). Background Art

[0004] In today's networked environment, the enterprise workforce is more distributed than ever before, which poses challenges when providing security to users wherever they are. As a result, the evolution of networking is moving enterprise applications from the data center to the cloud, where more and more applications are consumed as Software-as-a-Service (SAAS). The deployment of software-defined wide area networks (SD-WANs) enables enterprise organizations to securely connect users, applications, and data across multiple locations while providing improved performance, reliability, and scalability while providing centralized control and visibility of the entire network. SD-WAN can be integrated with cloud-delivered security services to create a secure access service edge (SASE) architecture. SASE unifies networking and security services as cloud-delivered services to provide access and security from edge to edge.

[0005] The integration of cloud security providers and SD-WAN networking requires coordination between network operations and security operations to define and implement security policies for decentralized enterprise organizations. Security operations security administrators are responsible for configuring security policies, and network operations network administrators are responsible for establishing SD-WAN overlays in the network. When security administrators are unaware of the SD-WAN network constructs involved in SD-WAN creation (e.g., VPNs, IP addresses, subnet pools, etc.), there is no unified policy definition between SD-WAN and security cloud providers, resulting in a complex coordination process in order to implement or update security policies. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] The detailed description is set forth below with reference to the accompanying drawings. In the drawings, the leftmost digit(s) of a reference number identifies the drawing in which the reference number first appears. The use of the same reference number in different drawings indicates similar or identical items. The systems depicted in the drawings are not drawn to scale, and the components in the drawings may not be drawn to scale with respect to each other.

[0007] Figure 1An example environment is shown in which aspects of the techniques related to automatically integrating SD-WAN fabric into SASE security policies and automating security policy enrichment based on events in the SD-WAN can be implemented.

[0008] Figure 2A An example of a dashboard of a secure cloud provider as described herein for defining security policies for an entity is shown.

[0009] Figure 2B An example of an SD-WAN controller dashboard for mapping security policies received from a secure cloud provider to a network fabric as described herein is shown.

[0010] Figure 3 is a flow chart illustrating an example method associated with the techniques described herein for mapping security policies to network fabrics.

[0011] Figure 4 A block diagram illustrating an example packet-switching system that can be used to implement aspects of the techniques disclosed herein is shown.

[0012] Figure 5 A block diagram illustrating certain components of an example node that may be used to implement aspects of the techniques disclosed herein is shown.

[0013] Figure 6 is a computer architecture diagram showing an illustrative computer hardware architecture for implementing a server device that can be used to implement aspects of the various techniques presented herein. DETAILED DESCRIPTION

[0014] Overview

[0015] Various aspects of the invention are set out in the independent claims and preferred features are set out in the dependent claims. Features of one aspect may be applicable to each aspect alone or in combination with other features.

[0016] The present disclosure describes a method (or methods) for mapping a networking fabric on an SD-WAN to a label used by a secure cloud provider in a policy definition. The method includes: defining, by a secure cloud provider, a security policy for an entity represented by a virtual private network (VPN) policy label, wherein the security policy has no source Classless Inter-Domain Routing (CIDR) Internet Protocol (IP) address and no destination CIDR IP address. In addition, the method includes: notifying, by the secure cloud provider, the security policy to an SD-WAN controller. The method also includes: mapping, by the SD-WAN controller, the VPN security policy label to an IP address pool and a VPN ID. In addition, the method includes: automatically and at least in part based on the mapping, by the SD-WAN controller, adding a source CIDR IP address and a destination CIDR IP address to the security policy to generate an enhanced security policy. The method also includes: transmitting, by the SD-WAN controller, the enhanced security policy to the secure cloud provider. The method may also include: deploying, by the SD-WAN controller, the enhanced security policy to an SD-WAN branch router. Finally, the method includes: generating, by the SD-WAN controller, a VPN segment between the SD-WAN branch router and the secure cloud provider to establish a public secure Internet gateway tunnel for the IP address pool.

[0017] Additionally, the techniques described herein may be performed by a system and / or device having a non-transitory computer-readable medium storing computer-executable instructions that, when executed by one or more processors, perform the methods described above.

[0018] Example Embodiments

[0019] As described above, software-defined wide area network (SD-WAN) is a software-defined approach to managing WANs in response to the ongoing major technology shift to decentralized networking and security. Enterprise organizations are rapidly transforming their infrastructure from a centralized data center model to a decentralized cloud model with features designed to deliver secure site-to-site and site-to-cloud connections from any location. SD-WAN can optimize the user experience and efficiency of SaaS and public cloud applications, and simplify operations with automation and cloud-based management that enables enterprise organizations to securely connect users and applications across multiple locations. In addition, Secure Access Service Edge (SASE) combines SD-WAN with advanced cloud delivery security features.

[0020] Today, integration of a security cloud provider or SASE secure internet gateway (SIG) provider with an SD-WAN architecture requires coordination between security operations administrators and network operations administrators. It is expected that the SIG provider administrator will know the SD-WAN network constructs (e.g., segmentation, IP addresses, VPNs, CDIRs, or any other constructs required to implement security policies associated with the SD-WAN) from the SD-WAN administrator in order to effectively define security policies for entities connected to the SD-WAN. For example, when defining security policies for an enterprise organization's engineering department, the security cloud provider administrator needs to know the SD-WAN network constructs (e.g., IP subnet information for the engineering department) and manually enter them into the security cloud provider dashboard in order to successfully configure the security policy for the engineering department and successfully apply the policy to all network communications to and from engineering personnel associated with the enterprise organization. However, traditionally, the security cloud provider administrator is unaware of the SD-WAN network constructs and therefore must coordinate with the SD-WAN network operations to obtain the necessary information, which must then be manually entered by the security operations administrator to effectively configure the security policy.

[0021] This disclosure describes a technique for automatically integrating SD-WAN fabrics into SASE security policies. By using security policy tags known to both the security cloud provider and the SD-WAN fabric controller (e.g., "engineering department" in the above example), the security cloud provider can define policies, and the SD-WAN controller can automatically map network fabrics to security policy tags, thereby enhancing security policies, and push the enhanced security policies including the fabrics to the security cloud provider, and deploy the enhanced security policies to network edge or branch devices.

[0022] When security policies are defined by a security cloud provider or SIG provider (e.g., Cisco Umbrella, Zscaler, etc.), new security policies are typically initiated by the security operations administrator via the security operations dashboard user interface. The security cloud provider only needs to enter the security policy label (e.g., "Engineering Department") and policy details (e.g., allow (or block) access to applications for users in the "Engineering Department"). The security operations administrator does not need to enter any SD-WAN network segmentation details for the policy. For example, the source CIDR IP address and the destination CIDR IP address do not need to be known and entered by the security cloud provider's security operations administrator.

[0023] When the security operations administrator defines security policies, the SD-WAN network administrator defines IP pools for each VPN, site, region, or geographic location via the network operations dashboard user interface of the SD-WAN controller. The IP pools are defined in a dedicated IP space, and the VPN ID is encoded in the IP address as the second octet. The SD-WAN controller reads the security policy tags defined by and received from the security cloud provider, and maps the security policy tags to department names (e.g., engineering department) and VPN IDs. The SD-WAN controller pulls the IP pool information for the VPN ID to automatically define each VPN Dynamic Host Configuration Protocol (DHCP) pool template, and the SD-WAN controller pushes the enhanced security policy to the SD-WAN devices. In addition, the SD-WAN controller enhances the security policy to include network segmentation details (e.g., source CIDR address and destination CIDR address) and sends an HTTP PUT request with the enhanced security policy back to the security cloud provider.

[0024] Essentially, security policies are defined by the security cloud provider using only security policy tags (e.g., enterprise organization department name, site name, geographic location name, etc.) that represent network segments in the SD-WAN. Security policies defined by the SIG provider are pulled into the SD-WAN controller via an application programming interface (API) when triggered by events (e.g., VPN definition, IP address pool creation, new branch device onboarding, etc.). Extended information of the segments present on the SD-WAN side is automatically mapped to security policy tags by the SD-WAN controller, thereby enhancing the security policy. This extension of the security policy binds networking-side details (e.g., IP addresses, tunnel names, etc.) representing site and device information into the security policy. In addition, the SD-WAN controller converts policy intent from the security cloud provider into an SD-WAN security policy to be pushed to the SD-WAN device to maintain the same security posture for non-SIG traffic. Therefore, the security posture is defined once and used for both cloud security and on-prem security.

[0025] In addition to the events that trigger the pulling of security policy tags defined by the SIG provider into the SD-WAN controller, a periodic pull can be configured using the security policy pull time interval to periodically pull security definitions from the security cloud provider. Thus, in the event that the security cloud provider initiates a security policy change for an entity, the SD-WAN controller will be notified of this change due to the periodic pull of security definitions from the security cloud provider via the API.

[0026] In addition, on the SD-WAN operation side, security policy enhancements are automated based on events in the SD-WAN. For example, VPN addition / deletion or network device addition / deletion can automatically trigger a security policy update for the SD-WAN controller. When a VPN is added or removed, the security policy can be automatically updated by the SD-WAN controller. Similarly, whenever a branch router is added or removed, the SD-WAN controller can update the security policy with the correct networking information. Once the SD-WAN controller updates the security policy, the SD-WAN controller automatically pushes the enhanced / updated policy to the security cloud provider, and deploys the enhanced / updated security policy to the SD-WAN devices. Therefore, by seamlessly integrating the SD-WAN construct into the SASE security policy, the overall user experience is enhanced and operational complexity is reduced.

[0027] Certain implementations and embodiments of the present disclosure will now be described more fully below with reference to the accompanying drawings, in which various aspects are shown. However, various aspects can be implemented in many different forms and should not be construed as being limited to the implementations set forth herein. As described herein, the present disclosure encompasses variations of the embodiments. Similar reference numerals refer to similar elements throughout.

[0028] Figure 1 An example environment 100 is shown in which various aspects of the technology related to automatically integrating SD-WAN fabric into SASE security policies can be implemented. The environment 100 includes security operations 102 and network operations 104. Security operations 102 are responsible for defining security policies, and network operations 104 are responsible for establishing SD-WAN overlays. Security operations 102 are unaware of SD-WAN overlay creation and therefore do not know the SD-WAN fabric information (VPN ID, IP address, subnet pool, etc.) required to implement security policies for entities. Therefore, traditionally, excessive coordination and information sharing and manual intervention are required between security operations 102 and network operations 104 in order for security operations to effectively create security policies for enterprise organizations connected to the SD-WAN. By implementing the technology described herein, the network fabric can be extracted from security operations 102 when defining security policies. The security policy can then be automatically enhanced by the SD-WAN network operations 104 to include the network fabric, and pushed back to security operations 102, as well as deployed to SD-WAN network edge and branch devices.

[0029] The security operations 102 in the example environment 100 include a secure cloud provider 106. The secure cloud provider 106 provides a secure internet gateway (SIG) connection for an enterprise organization. Figure 1The illustrated security cloud provider 106 includes features such as DNS layer security, a secure web gateway, a cloud delivery firewall, a cloud access security broker (CASB), and an interactive threat library (threat intel). However, the features provided by the security cloud provider 106 are examples of services that may be provided by a security cloud provider, and each security cloud provider may provide more or fewer services and similar or different services, but it is assumed that the security cloud provider provides at least a secure internet gateway. Examples of security cloud providers are Cisco Umbrella or Zscaler, but may be any appropriate security cloud provider that provides a secure internet gateway and other network security services to enterprise organizations. For the security cloud provider 106, the security operations 102 also include a security operations administrator 108. The security operations administrator 108 can define security policies for the network enterprise via the security cloud provider's dashboard, see below. Figure 2A Let's describe the process in detail.

[0030] The network operations 104 include one or more SD-WAN network controllers 110. The SD-WAN network controllers 110 include a network management system with a dashboard that acts as a window into the SD-WAN and through which network management can interact with the system. Figure 2B The network operation dashboard is described in detail. The network operation 104 also includes SD-WAN branch router-1 112 and SD-WAN branch router-2 114. The SD-WAN branch router-1 112 includes the engineering department and the marketing department of the enterprise organization, and the SD-WAN branch router-2 114 includes the engineering department and the sales department of the enterprise organization. Figure 1 Also included is a direct Internet access tunnel (IPsecVPN tunnel) 116 that connects the SD-WAN branch router-1 112 and the SD-WAN branch router-2 114 to the secure cloud provider 106.

[0031] The security cloud provider 106 defines security policies for entities using only VPN security policy tags, which represent network segments in the SD-WAN. For example, the security administrator 108 can define security policies for the "Engineering Department", "Marketing Department", and "Sales Department" that exist at the SD-WAN branch router-1 112 and the SD-WAN branch router-2 114. The VPN security policy tags representing the security policies can be entered by the security administrator 108 into the following reference Figure 2AIn the secure cloud provider 106 dashboard described in the figure, when entering the VPN security policy tag representing the network segment in the SD-WAN, the security administrator does not need to know or manually enter the network segment information (such as protocol, tunnel name, source CIDR IP address and destination CIDR IP address, etc.).

[0032] The security policy (VPN security policy tags representing network segmentation) defined by the security cloud provider 106 is pulled into the (one or more) SD-WAN network controllers 110 of the network operations 104 through an out-of-band API. The (one or more) SD-WAN network controllers 110 map the VPN security policy tags to IP address pools and VPN IDs. The source CIDR IP address and the destination CIDR IP address are added to the security policy to generate an enhanced security policy, and the enhanced security policy is pushed back to the cloud security provider 106 (via an HTTP PUT request). In addition, the IP pool information is used to automatically define each VPN DHCP pool template and is pushed to the SD-WAN network edge devices and branch devices. The SD-WAN network controller 110 then adds the IP pool information to the SD-WAN branch routers (e.g., SD-WAN branch router-1 112 and SD-WAN branch router-2 114) and as Figure 1 An IPsec VPN segment is shown to be generated between the secure cloud provider 106 as an IPsec direct Internet access tunnel 116. The IPsec VPN segment establishes a common secure Internet gateway tunnel between the branch device and the secure cloud provider 106.

[0033] In addition to pushing the enhanced security policies back to the cloud security provider 106, the SD-WAN controller 110 also deploys the enhanced security policies to the on-premises devices, thereby providing the same security posture for on-premises security and cloud security. In other words, the security policies are defined once by the security administrator 108 of the secure cloud provider 106, enhanced by the SD-WAN controller 110, pushed back to the secure cloud provider 106 and deployed to other SD-WAN network devices (e.g., SD-WAN branch router-1 112 and SD-WAN branch router-2 114), thereby providing the same security posture for on-premises security and cloud security.

[0034] Figure 2A An example secure cloud provider dashboard 200A is shown for defining security policies for an entity. The secure provider dashboard 200A is merely an example, and any given secure cloud provider dashboard may have more or fewer options, similar or different options, the same or different interactive elements (e.g., drop-down menus, selection buttons, text boxes, etc.), and may be displayed in a similar or different layout.

[0035] The secure cloud provider dashboard 200A may be used by administrators of security operations 202 to define security policies for entities. Figure 2A In the example shown, the security policy tag 204 is defined as "sales", indicating that it is a security policy for the sales department of an enterprise organization. The policy for the sales department is to "block" access to applications or specific data, etc. (not specifically shown). Traditionally, when a security policy is defined by the security operation 202 of a security cloud provider, the administrator needs to know and manually enter the protocols to be specified as well as the source and destination tunnels, CIDR IP addresses, and ports. However, by implementing the techniques described herein, the protocols, source and destination tunnels, CIDR IP addresses, and ports do not need to be manually entered by the security operation administrator of the security cloud provider. They can be set to "any" or remain blank, without explicitly specifying any specific protocol, tunnel, CIDR IP address, or port. Security policies are defined only by security policy tags that represent departments, sites, regions, etc. of an enterprise organization. This greatly reduces the number of security operations 202 and network operations 206 ( Figure 2B 202 and network operations 206 do not need to agree on the network scope required for security policy definition.

[0036] Figure 2B An example of an SD-WAN controller dashboard 200B for mapping security policies received from a secure cloud provider's security operations 202 to a network fabric as described herein is shown. Figure 2A The illustrated security provider dashboard, SD-WAN controller dashboard 200B, is merely an example, and any given security cloud provider dashboard may have more or fewer options, the same or different options, the same or different interactive elements, and may be displayed in a similar or different manner.

[0037] The SD-WAN controller dashboard can be used by administrators of network operations 206 to define IP pools, such as Figure 2B Three IP pools (project, region, site) have been predefined and are shown on the display of the dashboard pool window 208 . Figure 2B Also included is an example Add Pool pop-up window 210 for defining a new IP pool. Figure 2AThe security policy tag “Sales” defined in the secure cloud provider dashboard 200A is pulled into the SD-WAN controller dashboard 200B via the API and is shown in the “Pool Name” in the Add Pool pop-up window 210. The SD-WAN controller knows which IP pool is assigned to the Sales department, so when the pool name “Sales” is indicated as the IP pool to be added, the SD-WAN maps the VPN ID, IP subnet, and prefix length to the “Sales” security policy tag by automatically populating the VPN ID, IP subnet, and prefix length in the Add Pool pop-up window 210. By mapping the network constructs (VPN ID, IP subnet, and prefix length) to the “Sales” security policy tag, the SD-WAN controller enhances the “Sales” security policy, pushes the enhanced security policy back to the SIG provider via an HTTP PUT request, and deploys the enhanced security policy to the SD-WAN network devices (e.g., Figure 1 SD-WAN branch router-1 112 and SD-WAN branch router-2 114) as shown and described above.

[0038] Figure 3 is a flow chart illustrating an example method 300 associated with the techniques described herein for seamlessly integrating SD-WAN fabric into SASE security policies. The example method 300 illustrates a method for integrating SD-WAN fabric into SASE security policies. Figure 1 The security operations 102 and network operations 104 described herein perform various aspects of the functions performed. Figure 3 The described logical operations may be implemented as (1) a sequence of computer-implemented actions or program modules running on a computing system and / or (2) interconnected machine logic circuits or circuit modules within a computing system. In some examples, method(s) 300 may be performed by a system including one or more processors and one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform method(s) 300.

[0039] The implementation of the various components described herein is a matter of choice, depending on the performance and other requirements of the computing system. Accordingly, the logical operations described herein are variously referred to as operations, structural devices, actions, or modules. These operations, structural devices, actions, and modules may be implemented in software, firmware, dedicated digital logic, and any combination thereof. It should also be understood that more than one embodiment of the present invention may be implemented. Figure 3The invention also can be used to describe more or less operations shown and described herein. These operations can also be performed in parallel, or in an order different from that described herein. Some or all of these operations can also be performed by components other than those specifically identified. Although the techniques described in this disclosure refer to specific components, in other examples, these techniques can be implemented by fewer components, more components, different components, or any configuration of components.

[0040] At operation 302, the security cloud provider defines a security policy for an entity. The entity is represented by a VPN security policy tag, and the security policy does not include a source CIDR IP address or a destination CIDR IP address to which the security policy applies. The policy defined by the security cloud provider is a simple language version of a policy directive. For example, "Allow (or block) access to the Internet for the engineering department." The policy does not have any network configuration details. For example, in Figure 1 In the security cloud provider 106, security policies can be defined for engineering, marketing, and / or sales. Figure 2A , where the security operation defines a VPN security policy tag 204 "Sales" in the security cloud operation dashboard 200A. The security policy does not require any network configuration to be entered. Figure 2A As shown, the protocol and source and destination information (tunnel, CIDR IP address, and port) are entered as "Any".

[0041] At operation 304, the secure cloud provider notifies the SD-WAN controller of the security policy. Whenever a new security policy is defined or updated by the secure cloud provider, the SD-WAN controller pulls the policy into the dashboard via the out-of-band API. Figure 1 , the SD-WAN network controller 110 receives security policies defined by the security cloud provider 106. Figure 2B , where the SD-WAN controller dashboard 200B shows the pool name "Sales" in the pool name of the Add Pool pop-up window 210, which corresponds to the pool name added by the security operation 202 in the example Figure 2A The security policy tag 204 “Sales” is shown defined in the secure cloud provider dashboard 200A.

[0042] At operation 306, the SD-WAN controller maps the VPN security policy tag to the IP address pool and VPN ID. The SD-WAN controller reads the VPN security policy tag received from the secure cloud provider, maps the VPN security policy tag to the VPN ID, and pulls the IP address pool information for the VPN ID. Figure 2B, once the SD-WAN controller pulls the security policy tag "Sales" into the pool name of the Add Pool pop-up window 210, the VPNID, IP subnet, and prefix length portions of the Add Pool pop-up window 208 are automatically populated with the network segmentation information associated with "Sales".

[0043] At operation 308, the SD-WAN controller automatically adds the source CIDR IP address and the destination CIDR IP address to the security policy to generate an enhanced security policy. Figure 2B , the source CIDR IP address and the destination CIDR IP address in the IP subnet 10.7.0.0 are automatically added to the security policy to generate an enhanced security policy.

[0044] At operation 310, the SD-WAN controller transmits the enhanced security policy to the secure cloud provider. Figure 1 Once the SD-WAN network controller 110 generates the enhanced security policy, the enhanced security policy is pushed back to the secure cloud provider 106 (e.g., via an HTTP PUT request). In addition, when a triggering event occurs in the SD-WAN (e.g., VPN addition / deletion or network device addition / deletion), the enhanced security policy is automatically updated by the SD-WAN network controller 110 and pushed to the secure cloud provider 106.

[0045] At operation 312, the SD-WAN controller deploys the enhanced security policy to the SD-WAN branch routers. Figure 1 Once the SD-WAN network controller 110 generates the enhanced security policy, the SD-WAN network controller 110 deploys the enhanced security policy to the SD-WAN network devices (e.g., SD-WAN branch router-1 112 and SD-WAN branch router-2 114). Similar to operation 310, when a triggering event occurs in the SD-WAN (e.g., VPN addition / deletion or network device addition / deletion), the enhanced security policy is automatically updated and deployed to the SD-WAN network devices (e.g., SD-WAN branch router-1 112 and SD-WAN branch router-2 114) by the SD-WAN network controller 110. Therefore, the policy intent from the security cloud provider 106 is converted into an SD-WAN security policy and pushed to the SD-WAN devices to maintain the same security posture for non-SIG traffic.

[0046] At operation 314, the SD-WAN controller generates a VPN segment between the SD-WAN branch router and the secure cloud provider to establish a public secure Internet gateway tunnel to the IP address pool. Figure 1, the SD-WAN network controller 110 generates a VPN segment, namely a direct Internet access tunnel (IPsec) 116, between the branch routers (router-1 112 and router-2 114) and the security provider 106.

[0047] Figure 4 A block diagram illustrating an example packet switching device (or system) 400 that can be used to implement various aspects of the technology disclosed herein is shown. In some examples, the network can be used in various networks (e.g., reference Figure 1

[0063] The described SD-WAN network uses (one or more) packet switching devices 400 in the SD-WAN branch router-1 112 and the SD-WAN branch router-2 114).

[0048] In some examples, the packet switching system 400 may include multiple line cards 402, 410, each line card having one or more network interfaces for sending and receiving packets over a communication link (e.g., which may be part of a link aggregation group). The packet switching device 400 may also have a control plane having one or more processing elements for managing the control plane and / or control plane packet processing associated with packet forwarding in the network. The packet switching device 400 may also include other cards 408 (e.g., service cards, blades), which include processing elements for processing (e.g., forwarding / sending, discarding, manipulating, changing, modifying, receiving, creating, copying, applying services) packets associated with packet forwarding in the network. The packet switching device 400 may include a hardware-based communication mechanism 406 (e.g., a bus, a switching structure and / or a matrix, etc.) to allow its different entities, line cards (402, 404, 408 and 410) to communicate. For a number of other specific packets and / or packet flows received by or sent from the packet switching device 400 , the line card(s) 402 , 410 may generally perform the actions of both an ingress line card 402 , 410 and an egress line card 402 , 410 .

[0049] Figure 5 A block diagram illustrating certain components of an example node 500 that can be used to implement various aspects of the techniques disclosed herein is shown. In some examples, (one or more) nodes 500 can be used in various networks (e.g., reference Figure 1 SD-WAN network described in the previous section).

[0050] In some examples, node 500 may include any number of line cards 502 (e.g., line cards 502(1)-(N), where N may be any integer greater than 1) that are communicatively coupled to forwarding engines 510 (also referred to as packet forwarders) and / or processors 520 via data buses 530 and / or result buses 540. Line cards 502(1)-(N) may include any number of port processors 550(1)(A)-(N)(N) controlled by port processor controllers 560(1)-(N), where N may be any integer greater than 1. Additionally or alternatively, forwarding engines 510 and / or processors 520 may be coupled to each other not only via data buses 530 and result buses 540, but may also be communicatively coupled to each other via communication links 570.

[0051] The processors of each line card 502 (e.g., port processor(s) 550 and / or port processor controller(s) 560) may be mounted on a single printed circuit board. When a packet or packet and header is received, the packet or packet and header may be identified and analyzed by the node 500 (also referred to herein as a router) in the following manner. Upon receipt, the packet (or some or all of its control information) or packet and header may be sent from one of the port processor(s) 550(1)(A) to (N)(N) that receives the packet or packet and header and is sent to one or more of those devices coupled to the data bus 530 (e.g., other port processors of the port processors 512(1)(A) to (N)(N), the forwarding engine 510, and / or the processor 520). The processing of the packet or packet and header may be determined, for example, by the forwarding engine 510. For example, the forwarding engine 510 may determine that the packet or packet and header should be forwarded to one or more of the port processors of the port processors 550(1)(A) to (N)(N). This may be accomplished by indicating to a corresponding port processor controller 560(1)-(N) that a packet or a copy of a packet and a header stored in a given port processor(s) in port processors 550(1)(A)-(N)(N) should be forwarded to an appropriate port processor in port processor(s) 512(1)(A)-(N)(N). Additionally or alternatively, once a packet or a packet and a header has been identified for processing, forwarding engine 510, processor 520, etc. may be used to process the packet or a packet and a header in some manner and / or packet security information may be added to protect the packet. At node 500 that originates such a packet or a packet and a header, such processing may include, for example, encrypting some or all of the information in the packet or a packet and a header, adding a digital signature and / or some other information, and / or processing that is capable of protecting the packet or a packet and a header. At a node 500 that receives such processed packets or packets and headers, corresponding processing may be performed to recover or verify the information of the packets and / or headers that have been protected.

[0052] Figure 6 An example computer architecture is shown for a computing device (or network routing device) 600 that is capable of executing program components for implementing the functionality described above. Figure 6 The computer architecture shown illustrates a conventional server computer, workstation, desktop computer, laptop computer, tablet computer, network device, e-reader, smart phone, or other computing device, and can be used to execute any software components presented herein. In some examples, computing device 600 can correspond to the respective references herein. Figure 1 , Figure 4 and Figure 5 The SD-WAN network controller 110, packet switching system 400 and / or node 500 are described.

[0053] The computing device 600 includes a substrate (or "motherboard") 602, which is a printed circuit board to which a number of components or devices may be connected by way of a system bus or other electrical communication paths. In one illustrative configuration, one or more central processing units ("CPUs") 604 operate in conjunction with a chipset 606. The CPU 604 may be a standard programmable processor that performs the arithmetic and logic operations necessary for the operation of the computing device 600.

[0054] The CPU 604 performs operations by transitioning from one discrete physical state to the next, where the state transitions are achieved by manipulating switching elements that distinguish and change these states. Switching elements generally include electronic circuits that maintain one of two binary states, such as flip-flops, and electronic circuits that provide output states based on logical combinations of the states of one or more other switching elements, such as logic gates. These basic switching elements can be combined to create more complex logic circuits, including registers, adders and subtractors, arithmetic logic units, floating point units, etc.

[0055] Chipset 606 provides an interface between CPU 604 and the remaining components and devices on baseboard 602. Chipset 606 may provide an interface with RAM 608, which is used as main memory in computing device 600. Chipset 606 may also provide an interface with a computer-readable storage medium, such as read-only memory (ROM) 610 or non-volatile RAM (NVRAM), which is used to store basic routines that help start computing device 600 and transfer information between various components and devices. ROM 610 or NVRAM may also store other software components necessary for the operation of computing device 600 according to the configuration described herein.

[0056] The computing device 600 may operate in a networked environment using logical connections to remote computing devices and computer systems through a network, such as network 624. Chipset 606 may include functionality for providing network connectivity through NIC 612, such as a Gigabit Ethernet adapter. NIC 612 is capable of connecting the computing device 600 to other computing devices through network 624. It should be appreciated that multiple NICs 612 may be present in the computing device 600, connecting the computer to other types of networks and remote computer systems.

[0057] The computing device 600 can be connected to a storage device 618 that provides non-volatile storage for the computing device 600. The storage device 618 can store an operating system 620, a program 622, and data, which have been described in more detail herein. The storage device 618 can be connected to the computing device 600 via a storage controller 614 connected to the chipset 606. The storage device 618 can be composed of one or more physical storage units. The storage controller 614 can be interfaced with the physical storage unit via a serial attached SCSI (serial attached SCSI, "SAS") interface, a serial advanced technology attachment (serial advanced technology attachment, "SATA") interface, a fiber channel (fiber channel, "FC") interface, or other types of interfaces for physically connecting and transmitting data between a computer and a physical storage unit.

[0058] The computing device 600 can store data on the storage device 618 by transforming the physical state of the physical storage unit to reflect the information being stored. In different embodiments of the present specification, the specific transformation of the physical state may depend on various factors. Examples of such factors may include, but are not limited to, the technology used to implement the physical storage unit, whether the storage device 618 is characterized as primary storage or secondary storage, etc.

[0059] For example, the computing device 600 may store information to the storage device 618 by issuing instructions through the storage controller 614 to change the magnetic properties of a specific location within a disk drive unit, the reflective or refractive properties of a specific location in an optical storage unit, or the electrical properties of a specific capacitor, transistor, or other discrete component in a solid-state storage unit. Other transformations of the physical media are possible without departing from the scope and spirit of the present specification, and the foregoing examples are provided only for the convenience of the present specification. The computing device 600 may further read information from the storage device 618 by detecting the physical state or properties of one or more specific locations within the physical storage unit.

[0060] In addition to the mass storage device 618 described above, the computing device 600 may also access other computer-readable storage media to store and retrieve information (e.g., program modules, data structures, or other data). It should be understood by those skilled in the art that a computer-readable storage medium is any available medium that provides non-transitory storage of data and can be accessed by the computing device 600. In some examples, the operations performed by (one or more) network devices 102 to 108 and / or any components included therein may be supported by one or more devices similar to the computing device 600. In other words, some or all of the operations performed by (one or more) network devices 102-108 and / or any components included therein may be performed by one or more computing devices 600 operating in a cloud-based arrangement.

[0061] By way of example, and not limitation, computer-readable storage media may include volatile and nonvolatile, removable and non-removable media implemented in any method or technology. Computer-readable storage media include, but are not limited to, RAM, ROM, erasable programmable ROM ("EPROM"), electrically-erasable programmable ROM ("EEPROM"), flash memory or other solid-state memory technology, compact disc ROM ("CD-ROM"), digital versatile disk ("DVD"), high definition DVD ("HD-DVD"), BLU-RAY or other optical storage, cassettes, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information in a non-transitory manner.

[0062] As briefly mentioned above, the storage device 618 may store an operating system 620 that is used to control the operation of the computing device 600. According to one embodiment, the operating system comprises a LINUX operating system. According to another embodiment, the operating system comprises an LINUX operating system from MICROSOFT Corporation of Redmond, Washington. SERVER operating system. According to another embodiment, the operating system may include a UNIX operating system or one of its variants. It should be understood that other operating systems may also be used. Storage device 618 may store other systems or applications and data utilized by computing device 600.

[0063] In one embodiment, the storage device 618 or other computer-readable storage medium is encoded with computer-executable instructions that, when loaded into the computing device 600, transform the computer from a general-purpose computing system into a special-purpose computer capable of implementing the embodiments described herein. As described above, these computer-executable instructions transform the computing device 600 by specifying how the CPU 604 transitions between states. According to one embodiment, the computing device 600 is able to access a computer-readable storage medium storing computer-executable instructions that, when executed by the computing device 600, perform the above-referenced Figure 3 The computing device 600 may also include a computer-readable storage medium having stored thereon instructions for performing any other computer-implemented operations described herein.

[0064] The computing device 600 may also include one or more input / output controllers 616 for receiving and processing input from a number of input devices (e.g., a keyboard, a mouse, a touch pad, a touch screen, an electronic stylus, or other types of input devices). Similarly, the input / output controller 616 may provide output to a display (e.g., a computer monitor, a flat-panel display, a digital projector, a printer, or other types of output devices). It will be appreciated that the computing device 600 may not include Figure 6 All components shown in the Figure 6 Other components not explicitly shown may be used in conjunction with Figure 6 A completely different architecture is shown in .

[0065] In general, techniques for automatically integrating SD-WAN construction into security policies are described. The techniques may include: defining a security policy by a secure cloud provider for an entity, the entity being represented by a VPN security policy tag, and the security policy having no source CIDR IP address and no destination CIDR IP address. The secure cloud provider notifies the SD-WAN controller of the security policy. The SD-WAN controller maps the VPN security policy tag to an IP address pool and a VPN ID. The SD-WAN controller generates an enhanced security policy by automatically adding the source CIDR IP address and the destination CIDR IP address to the security policy. The SD-WAN controller deploys the enhanced security policy to the SD-WAN branch router, and generates a VPN segment between the SD-WAN branch router and the secure cloud provider to establish a public secure Internet gateway tunnel for the IP address pool.

[0066] Although the present invention has been described with respect to specific embodiments, it should be understood that the scope of the present invention is not limited to these specific embodiments. Because other modifications and changes that change to adapt to specific operating requirements and environments are obvious to those skilled in the art, the present invention is not considered to be limited to the examples selected for the purpose of disclosure, but includes all changes and modifications that do not constitute a deviation from the true spirit and scope of the present invention.

[0067] Although the present application describes embodiments with specific structural features and / or method actions, it should be understood that the claims are not necessarily limited to the specific features or actions described. Instead, the specific features and actions are merely illustrative of some embodiments falling within the scope of the claims of the present application.

Claims

1. A method for automatically integrating a software defined wide area network (SD-WAN) configuration into a security policy, the method comprising: A security policy is defined by a security cloud provider for an entity, the entity being represented by a virtual private network (VPN) security policy label, wherein the security policy has no source Classless Inter-Domain Routing (CIDR) Internet Protocol (IP) address and no destination CIDR IP address; The security cloud provider notifies the SD-WAN controller of the security policy; The SD-WAN controller maps the VPN security policy label to an IP address pool and a VPN ID; automatically, by the SD-WAN controller and based at least in part on the mapping, adding a source CIDR IP address and a destination CIDR IP address to the security policy to generate an enhanced security policy; transmitting, by the SD-WAN controller, the enhanced security policy to the secure cloud provider; deploying, by the SD-WAN controller, the enhanced security policy to the SD-WAN branch routers; and A VPN segment is generated by the SD-WAN controller between the SD-WAN branch router and the secure cloud provider to establish a public secure Internet gateway tunnel for the IP address pool.

2. The method according to claim 1, wherein: The SD-WAN controller is notified of the security policy via an out-of-band application programming interface (API).

3. The method according to claim 1 or 2, wherein: The VPN ID is encoded in the IP address as the second octet.

4. The method according to any one of claims 1 to 3, further comprising: The enhanced security policy is pushed to the local deployment devices by the SD-WAN controller, thereby providing the same security posture for local deployment security and cloud security.

5. The method according to any one of claims 1 to 4, further comprising: The enhanced security policy is automatically updated by the SD-WAN controller when VPNs are added or removed from the SD-WAN or when branch routers are added or removed.

6. The method according to any one of claims 1 to 5, wherein: The security policy is defined by the security operations administrator of the security cloud provider via the security provider dashboard, and the mapping of the VPN security policy tags is automatically displayed via the SD-WAN controller dashboard.

7. The method according to any one of claims 1 to 6, further comprising: IP pools are defined by the SD-WAN controller for each VPN, site, region or geography.

8. A system comprising: one or more processors; as well as One or more computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising: A security policy is defined by a security cloud provider for an entity, the entity being represented by a virtual private network (VPN) security policy label, wherein the security policy has no source Classless Inter-Domain Routing (CIDR) Internet Protocol (IP) address and no destination CIDR IP address; The security cloud provider notifies the SD-WAN controller of the security policy; The SD-WAN controller maps the VPN security policy label to an IP address pool and a VPN ID; automatically, by the SD-WAN controller and based at least in part on the mapping, adding a source CIDR IP address and a destination CIDR IP address to the security policy to generate an enhanced security policy; transmitting, by the SD-WAN controller, the enhanced security policy to the secure cloud provider; deploying, by the SD-WAN controller, the enhanced security policy to the SD-WAN branch routers; and A VPN segment is generated by the SD-WAN controller between the SD-WAN branch router and the secure cloud provider to establish a public secure Internet gateway tunnel for the IP address pool.

9. The system according to claim 8, wherein: The security policy is transmitted to the SD-WAN controller via an out-of-band application programming interface (API).

10. The system according to claim 8 or 9, wherein: The VPN ID is encoded in the IP address as the second octet.

11. The system according to any one of claims 8 to 10, wherein the operations further comprise: The enhanced security policy is pushed to the local deployment devices by the SD-WAN controller, thereby providing the same security posture for local deployment security and cloud security.

12. The system according to any one of claims 8 to 11, wherein the operations further comprise: When VPNs are added or removed or branch routers are added or removed, the security policy is automatically updated.

13. A system according to any one of claims 8 to 12, wherein: The security policy is defined by the security operations administrator of the security cloud provider via the security provider dashboard, and the mapping of the VPN security policy tags is automatically displayed via the SD-WAN controller dashboard.

14. The system according to any one of claims 8 to 13, further comprising: IP pools are defined by the SD-WAN controller for each VPN, site, region or geography.

15. One or more non-transitory computer-readable media storing instructions that, when executed, cause one or more processors to perform operations comprising: A security policy is defined by a security cloud provider for an entity, the entity being represented by a virtual private network (VPN) security policy label, wherein the security policy has no source Classless Inter-Domain Routing (CIDR) Internet Protocol (IP) address and no destination CIDR IP address; The security cloud provider notifies the SD-WAN controller of the security policy; The SD-WAN controller maps the VPN security policy label to an IP address pool and a VPN ID; automatically, by the SD-WAN controller and based at least in part on the mapping, adding a source CIDR IP address and a destination CIDR IP address to the security policy to generate an enhanced security policy; transmitting, by the SD-WAN controller, the enhanced security policy to the secure cloud provider; deploying, by the SD-WAN controller, the enhanced security policy to the SD-WAN branch routers; and A VPN segment is generated by the SD-WAN controller between the SD-WAN branch router and the secure cloud provider to establish a public secure Internet gateway tunnel for the IP address pool.

16. The one or more non-transitory computer readable media of claim 15, wherein: The security policy is transmitted to the SD-WAN controller via an out-of-band application programming interface (API).

17. One or more non-transitory computer readable media according to claim 15 or 16, wherein: The VPN ID is encoded in the IP address as the second octet.

18. The one or more non-transitory computer readable media of any one of claims 15 to 17, further comprising: The enhanced security policy is pushed to the local deployment devices by the SD-WAN controller, thereby providing the same security posture for local deployment security and cloud security.

19. The one or more non-transitory computer readable media of any one of claims 15 to 18, the operations further comprising: When VPNs are added or removed or branch routers are added or removed, the security policy is automatically updated.

20. The one or more non-transitory computer readable media of any one of claims 15 to 19, wherein: The security policy is defined by the security operations administrator of the secure cloud provider via the secure cloud provider dashboard, and the mapping of the VPN security policy tags is automatically displayed via the SD-WAN controller dashboard.

21. An apparatus for automatically integrating a software defined wide area network (SD-WAN) configuration into a security policy, the apparatus comprising: Means for defining, by a secure cloud provider, a security policy for an entity represented by a virtual private network (VPN) security policy label, wherein the security policy has no source Classless Inter-Domain Routing (CIDR) Internet Protocol (IP) address and no destination CIDR IP address; means for notifying the SD-WAN controller of the security policy by the secure cloud provider; means for mapping, by the SD-WAN controller, the VPN security policy label to an IP address pool and a VPN ID; means for automatically, by the SD-WAN controller and based at least in part on the mapping, adding a source CIDR IP address and a destination CIDR IP address to the security policy to generate an enhanced security policy; means for transmitting, by the SD-WAN controller, the enhanced security policy to the secure cloud provider; means for deploying, by the SD-WAN controller, the enhanced security policy to SD-WAN branch routers; and Means for generating, by the SD-WAN controller, a VPN segment between the SD-WAN branch router and the secure cloud provider to establish a common secure Internet gateway tunnel for the IP address pool.

22. The apparatus according to claim 21, further comprising: Module for implementing the method according to any one of claims 2 to 8.

23. A computer program, a computer program product or a computer readable medium comprising instructions which, when executed by a computer, cause the computer to perform the steps of the method according to any one of claims 1 to 8.

Images